chore: bump the Go toolchain to 1.26.9 for the stdlib security fixes

Bumps go1.26.6 -> go1.26.9 (go.mod toolchain, .go-version, CI image, Dockerfiles). Clears the 12 stdlib govulncheck advisories (GO-2026-6599..6617) blocking every pipeline; drops the stale GO-2026-4740 allowlist entry.